Machine learning model and narrative generator for prohibited transaction detection and compliance

ABSTRACT

There are provided systems and methods for a machine learning model and narrative generator for prohibited transaction detection and compliance. A service provider server, such as an electronic transaction processor, may generate a machine learning model using a supervised training technique, which may detect transactions that may be money laundering. The model may be iteratively trained by detecting flagged transactions and outputting those transactions to an agent for identification of false positives, which may be used to retrain the model. When outputting the flagged transactions, a narrative may be generated using an explainer graph and a machine learning prediction explainer that identifies the features of the transaction data that caused the transactions to be flagged. Further, once the model is trained additional transactions may be processed to determine whether the features of those transactions indicate prohibited behavior.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to and is a continuation of U.S. patentapplication Ser. No. 16/833,475, filed Mar. 27, 2020, all of which isincorporated herein by reference in its entirety.

TECHNICAL FIELD

The present application generally relates to machine learning modelstrained for prohibited transaction detection and more particularly to anengine having a machine learning model trained to detect potential moneylaundering transactions and output a narrative of why the transactionwas flagged by the engine, according to various embodiments.

BACKGROUND

Service providers may provide electronic transaction processing servicesto users, which may be used to send and receive funds with otherentities. Some of these services may be used maliciously or fraudulentlyby users, such as to conduct money laundering schemes. However, theseservice providers may process thousands (or more) transactions daily,which may be difficult to review without a large review and complianceteam. Therefore, Applicant recognizes that initial data processing maybe required to identify potential money laundering transactions or otherprohibited transactions. Further, when reviewing the data of potentiallymoney laundering transactions, agents may not be able to determine ordecipher the underlying data as to why the transaction may be a moneylaundering transaction. Thus, the decisions made about whichtransactions are flagged for regulatory review may not clear todifferent parties reviewing the flagged transaction.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a networked system suitable forimplementing the processes described herein, according to an embodiment;

FIG. 2 is an exemplary system environment of an artificial neuralnetwork implementing a machine learning model trained forclassifications based on training data, according to an embodiment;

FIG. 3A is an exemplary feature importance of decision made by a machinelearning engine trained for prohibited transaction detection, accordingto an embodiment;

FIG. 3B is an exemplary explanation graph of a machine learning enginetrained for prohibited transaction detection, according to anembodiment;

FIG. 4 is a flowchart of a machine learning model and narrativegenerator for prohibited transaction detection and compliance, accordingto an embodiment; and

FIG. 5 is a block diagram of a computer system suitable for implementingone or more components in FIG. 1 , according to an embodiment.

Embodiments of the present disclosure and their advantages are bestunderstood by referring to the detailed description that follows. Itshould be appreciated that like reference numerals are used to identifylike elements illustrated in one or more of the figures, whereinshowings therein are for purposes of illustrating embodiments of thepresent disclosure and not for purposes of limiting the same.

DETAILED DESCRIPTION

Provided are methods for a machine learning model and narrativegenerator for prohibited transaction detection and compliance. Systemssuitable for practicing methods of the present disclosure are alsoprovided.

A service provider server, which may provide a prohibited transactiondetection platform, may train a machine learning model through iterativetraining on a training data set. In this regard, a machine learningtechnique, such as gradient boosting or random forest algorithms, may beused to detect flagged transactions within the training data set thatindicate potential fraud. These may be then reviewed by an agent todetermine whether the flags may be false positives where thetransactions were flagged but do not indicate fraud to a sufficientlevel to require reporting to a regulatory body (e.g., an authority thathandles money laundering offenses and transactions). Once the falsepositives have been identified and used to retrain the modeliteratively, the model may then provide more accurate results forprohibited transaction detection. Thereafter further transactions may beprocessed using the model to identify and flag any transactions forpotential money laundering or other fraud.

Further, the service provider server may provide a process to generatenarratives automatically for review by the agents when reviewing flaggedtransactions for false positives and/or submission to a regulatoryagency. The narrative may be generated by the server by using a machinelearning prediction explainer that generates an explanation (which maybe partially or wholly in graph form) of what factors caused the machinelearning model to flag the transaction. For example, the explanationgraph may rank and/or provide values for each factor that influenced thedecision of the machine learning engine to flag the transaction and/oraccount sending or receiving money in the transactions based on thefeatures of the data (e.g., transaction amount, time, number oftransactions between accounts, etc.). Using the machine learningprediction explainer, a textual narrative may then be generated, whichexplains the features that caused the flag. This may be displayed withthe flagged transaction so that users may view a textual reasonexplaining why the engine and model flagged the transaction. Theprovided explanation text can aid a human reviewer, in variousinstances, in rapidly making a decision as to whether a flaggedtransaction should be sent to regulatory authority for additionalreview. (Note that in various jurisdictions, it is a requirement that ahuman provide a decision as to whether a prohibited transaction such asmoney laundering has occurred.)

In this regard, a service provider may provide electronic transactionprocessing to entities, such as users that may utilize the services ofthe service provider for both legitimate, fraudulent, and/or maliciouspurposes (e.g., money laundering). A user may correspond to some entity,such as consumers, merchants, etc., that may interact with the serviceprovider to establish an account and utilize the account for transactionprocessing. An account with a service provider may be established byproviding account details, such as a login, password (or otherauthentication credential, such as a biometric fingerprint, retinalscan, etc.), and other account creation details. The account creationdetails may include identification information to establish the account,such as personal information for a user, business or merchantinformation for an entity, or other types of identification informationincluding a name, address, and/or other information. The user may alsobe required to provide financial information, including payment card(e.g., credit/debit card) information, bank account information, giftcard information, benefits/incentives, and/or financial investments,which may be used to process transactions after identity confirmation.The online payment provider may provide digital wallet services, whichmay offer financial services to send, store, and receive money, processfinancial instruments, and/or provide transaction histories, includingtokenization of digital wallet data for transaction processing. Theapplication or website of the service provider, such as PayPal® or otheronline payment provider, may provide payments and the other transactionprocessing services.

Thus, the online service provider may provide account services to usersof the online service provider, which may be used to process electronictransactions. When processing transactions, accounts may generatetransaction data, which may include transaction histories and may beaccrued for each account in a transaction history or other account data.The service provider may therefore include large databases and stores ofprocessed transaction data, which may include both legitimate or validtransactions and those transactions that may be fraudulent due to moneylaundering, theft, and other illegal or malicious activities. Further,the service provider may have access to other transaction data,including training data of transactions that were processed by theservice provider or another entity. For example, the service providermay also have access to data processed by a regulatory agency ofreceived transactions indicating money laundering by the serviceprovider and/or other entities, as well as the actions taken by theregulatory agency to enforce laws, rules, or regulations (e.g.,transactions that led to money laundering counteractions or weredismissed for lack of evidence or incorrect flagging). In order toidentify those transactions that are money laundering, human agentsmight have to identify those transactions that were anomalous,irregular, or indicating fraud or otherwise prohibited behavior based onindividual transactions and/or patterns of behavior for accounts whentransacting. However, the money laundering transactions may only make upa portion of the overall transactions, and further the overalltransactions processed within a time period may include thousands ormillions of transactions. Therefore, it previously was inefficient tohave human agents reviewing all transactions within a data set.

Therefore, a machine learning engine may predict patterns of moneylaundering or irregular behavior that may be indicative of moneylaundering or other illegal or malicious conduct. In this regard, atraining data set may be used, where the training data set may includetransactions having a number of features. The features may include atype of system for the entity conducting the transaction (e.g., mobiledevice, web, etc.), an account number, a transaction identifier (ID), atransaction type (e.g., payment, gambling, etc.), an encryptedtransaction ID, a parent transaction ID, a created and/or update date, aUS dollar equivalent amount (e.g., where credits and sent payments maybe in a negative format), a local currency amount and/or code, a billingand/or shipping address, a funding source and/or backup funding source,a bank account number, a bank hash-based message authentication code(HMAC), a card number and/or hash, a card bun HMAC, a card issuer, abalance and/or impact on a balance due to the transaction, a transactionstatus and/or items within the transaction, notes and/or subject lineswithin messages for the transaction, an automated clearinghouse returncodes, an ID on another marketplace or platform, a counterparty name, acounterparty account number, a counterparty account type, a counterpartycountry code, a counterparty email, a counterparty transaction ID, acounterparty ID on a marketplace or platform, a counterparty accountstatus, a referring URL, an IP address, whether the transaction wassuccessful, and a date (e.g., month/year) of transaction. However, otherfeatures of the data set may also be used and processed to train amachine learning engine and/or identify flags on transactions within adata set.

Using the training data set, a machine learning technique may be appliedto classify the transactions within the data set. The machine learningtechnique may include gradient boosting, such as XGBoost, or randomforest algorithms. In this regard, the algorithms may generate decisiontrees that are utilized to understand the data. The algorithms maycorrespond to supervised processes that are used with data to placetransactions in different classifications based on classifiers for amachine learning model, such as “Prohibited” and “Not Prohibited.” Thetraining data may be labeled or may be on data having known patterns(e.g., valid transactions and/or prohibited transactions), and theprocess may include agent feedback on transactions that are flagged,such as whether they are properly flagged and what indicates potentialfraud for submission to a regulatory body or authority. The model may betrained and utilized by a neural network to make classifications, wherea hidden layer of the network may be trained with different values orattributes derived from the input values by the machine learning model.The nodes of the hidden layers may have different values and weightsassigned based on the machine learning algorithm applied to the inputlayer features, as discussed further below. Using the training data, theresulting network may be generated that classifies the input data in theoutput layer, such as by determining whether money laundering isindicated in transactions.

When first training the model, feedback may be useful from an agent toindicate whether the flagged transactions detected by the machinelearning engine are actually indicative of a prohibited transaction orwhether a false positive due to certain factors occur. For example, acoach may be paid $1,000 monthly for tennis lessons by an athlete, wherethis type of repetitive transaction, amount, and description may raiseconcerns of money laundering. However, this may be an entirelylegitimate transaction. Thus, the machine learning engine may classify aparticular transaction, set of transactions, and/or accounts aspotentially money laundering due to particular features of the data, themachine learning model's factors, weights, and/or values, and theparticular machine learning algorithm used to train the model. In orderto allow for agent review of the particular transaction in a coherentand straightforward manner (e.g., without reviewing the underlyingmachine learning decision-making factors, values, and/or graphs, whichmay be difficult for some agents), the service provider's engine mayutilize a machine learning prediction explainer to generate a textualnarrative based on an explanation graph for why the machine learningmodel flagged the particular transaction. For example, the explanationgraph may include factors that weighed in favor of the decision, and mayrank those factors as well as an overall rank, threshold, or scorecomparison that led to the transaction being flagged.

A narrative text generator may then generate text, which may showaccount identification, account balances and/or changing balances over atime period, and an explanation and identification of one or more of thefactors that led to the money laundering flag. For example, thenarrative text generator may show top 3 factors, such as counterpartyidentification, amount, and time/date/recurrence of the transactionsthat indicate potential fraud or other prohibited behavior by anaccount. Once this textual narrative is generated, the text may be fedinto a case management system that allows agents to review the flaggedtransaction. Thereafter, an agent may provide further feedback onwhether there are any false positives on the data. This may correspondto an iterative training of the machine learning model on previous falsepositives so that the false positives may be reduced and/or eliminatedthrough successive training of the model using the supervised machinelearning algorithm, the flagged transactions, and the false positives.

Accordingly, the machine learning model may be built and implemented ina service and/or engine of one or more service providers for detectionfor fraud. This allows service providers to quickly identify aprohibited transaction without being required to have live agentsindividually review transaction data. Thus, these automated processesallow for faster and more efficient review of data, while reducing falsepositives using iterative training of the model so that legitimate usersare not affected. Furthermore, by using a narrative text generator, anagent may quickly and efficiently review the engine's reason for takingsuch action to determine whether the model is behaving correctly or mayhave mis-classified some data. Thus, the number of resources utilized todetect money laundering patterns may be reduced.

FIG. 1 is a block diagram of a networked system 100 suitable forimplementing the processes described herein, according to an embodiment.As shown, system 100 may comprise or implement a plurality of devices,servers, and/or software components that operate to perform variousmethodologies in accordance with the described embodiments. Exemplarydevices and servers may include device, stand-alone, andenterprise-class servers, operating an OS such as a MICROSOFT® OS, aUNIX® OS, a LINUX® OS, or another suitable device and/or server-basedOS. It can be appreciated that the devices and/or servers illustrated inFIG. 1 may be deployed in other ways and that the operations performed,and/or the services provided by such devices and/or servers may becombined or separated for a given embodiment and may be performed by agreater number or fewer number of devices and/or servers. One or moredevices and/or servers may be operated and/or maintained by the same ordifferent entity

System 100 includes an agent device 110 and a service provider server120 in communication over a network 140. Agent device 110 may beutilized to provide training data, view flagged transactions, andprocess additional transaction data to identify transactions indicatinga prohibited transaction including potential money laundering. In thisregard, an agent may process and review the data with service providerserver 120, where service provider server 120 may generate a machinelearning model based on iteratively training using the training data,and further process the transaction data using the model to flag furthertransactions. Additionally, service provider server 120 may be used tooutput narratives for flagged transactions based on feature analysisthat caused the machine learning engine to perform a classification.

Agent device 110 and service provider server 120 may each include one ormore processors, memories, and other appropriate components forexecuting instructions such as program code and/or data stored on one ormore computer readable mediums to implement the various applications,data, and steps described herein. For example, such instructions may bestored in one or more computer readable media such as memories or datastorage devices internal and/or external to various components of system100, and/or accessible over network 140.

Agent device 110 may be implemented as a communication device that mayutilize appropriate hardware and software configured for wired and/orwireless communication with service provider server 120. For example, inone embodiment, agent device 110 may be implemented as a personalcomputer (PC), a smart phone, laptop/tablet computer, wristwatch withappropriate computer hardware resources, eyeglasses with appropriatecomputer hardware (e.g. GOOGLE GLASS®), other type of wearable computingdevice, implantable communication devices, and/or other types ofcomputing devices capable of transmitting and/or receiving data, such asan IPAD® from APPLE®. Although only one device is shown, a plurality ofdevices may function similarly and/or be connected to provide thefunctionalities described herein.

Agent device 110 of FIG. 1 contains an alert review application 112, adatabase 114, and a network interface component 116. Alert reviewapplication 112 may correspond to executable processes, procedures,and/or applications with associated hardware. In other embodiments,agent device 110 may include additional or different modules havingspecialized hardware and/or software as required.

Alert review application 112 may correspond to one or more processes toexecute software modules and associated components of agent device 110to provide features, services, and other operations associated withtraining a machine learning, deep learning, or other artificialintelligence (AI) model, as well as using the model for detection ofprohibited transactions in transaction data sets. In this regard, alertreview application 112 may correspond to specialized hardware and/orsoftware utilized by a user of agent device 110 that may be used toprovide training and transaction data, as well as review results of asupervised machine learning engine having a model trained for fraudulentpattern recognition and narrative text output. For example, alert reviewapplication 112 may be used to first provide training data and/or setsof data to service provider server 120 that includes transaction datasets for transaction processed by a financial entity, such as a bank orfinancial institution, payment service provider, or other transactionprocessor. Service provider server 120 may utilize features within thedata sets to classify the transactions according to one or moreclassifiers, which may flag one or more transactions as potentiallyprohibited based on laws, rules, or regulations. The data sets may beannotated, and flagged transactions may be displayed through alertreview application 112. An agent may identify any false positives in theflagging of transactions as potentially prohibited, which may beprovided back to service provider server 120 for retraining (e.g.,iteratively and/or continuously training) of the machine learning model.The flagged transactions may include a narrative displayable throughalert review application 112, such as a textual description of thereason for flagging the transaction(s) by the model. After training,agent device 110 may further be used to view the results of the modelprocessing other transaction data sets, such as for other transactionprocessed by one or more entities.

Agent device 110 may further include database 114 stored on a transitoryand/or non-transitory memory of agent device 110, which may storevarious applications and data and be utilized during execution ofvarious modules of agent device 110. Database 114 may include, forexample, identifiers such as operating system registry entries, cookiesassociated with alert review application 112 and/or other applications112, identifiers associated with hardware of agent device 110, or otherappropriate identifiers, such as identifiers used forpayment/user/device authentication or identification, which may becommunicated as identifying the user/agent device 110 to serviceprovider server 120. Database 114 may further include any transactiondata sets used for training and/or processing with a machine learningmodel generated by service provider server 120.

Agent device 110 includes at least one network interface component 116adapted to communicate with service provider server 120. In variousembodiments, network interface component 116 may include a DSL (e.g.,Digital Subscriber Line) modem, a PSTN (Public Switched TelephoneNetwork) modem, an Ethernet device, a broadband device, a satellitedevice and/or various other types of wired and/or wireless networkcommunication devices including microwave, radio frequency, infrared,Bluetooth, and near field communication devices.

Service provider server 120 may be maintained, for example, by an onlineservice provider, which may provide identification of prohibitedtransactions, such as money laundering transactions, in transaction datasets processed by a financial or transaction processing entity(including service provider server 130) using a machine learning orother AI model. In this regard, service provider server 120 includes oneor more processing applications which may be configured to interact withagent device 110 to train and utilize the model for prohibitedtransaction identification. In one example, service provider server 120may be provided by PAYPAL®, Inc. of San Jose, CA, USA. However, in otherembodiments, service provider server 120 may be maintained by or includeanother type of service provider.

Service provider server 120 of FIG. 1 includes a risk analysisapplication 130, a transaction processing application 122, a database124, and a network interface component 128. Risk analysis application130, transaction processing application 122, and other applications 134may correspond to executable processes, procedures, and/or applicationswith associated hardware. In other embodiments, service provider server120 may include additional or different modules having specializedhardware and/or software as required.

Risk analysis application 130 may correspond to one or more processes toexecute modules and associated specialized hardware of service providerserver 120 to provide a framework to train a machine learning modelusing for one or more engines that detect fraud in transaction datasets. In this regard, risk analysis application 130 may correspond tospecialized hardware and/or software used by a user associated withagent device 110 to train machine learning engine 132. Machine learningmodel 132 includes one or more executable programs and/or modelsconfigured to initially process one or more training data sets havingtransactions processed by an entity, including service provider server120. The transactions in the training data set(s) may include legitimatetransactions and malicious and/or fraudulent transactions, such as thosetransactions prohibited due to money launder laws, rules, andregulations when entity engage in illegal and/or malicious behavior. Thetraining data set may include labeled and/or unlabeled data, which mayinclude classifications of valid transactions and prohibitedtransactions (e.g., “no money laundering” or “potential or detectedmoney laundering,” respectively). These may be labeled by a humanoperator, such as an agent that reviews transactions for moneylaundering, fraud, and the like for reporting to a regulatory agency,body, or entity. Thus, one or more classifiers may be established by theagent or entity processing the data, or may be determined based onoutlier transactions or transactions having features indicatingprohibited conduct or behavior. Thus, the classifiers may be built andtrained so that classifications may be assigned to particular datapoints (e.g., transactions) within the training data set.

The training data set(s) include different features, such as a platformfor the transaction (e.g., mobile, web, etc.), an account number, atransaction identifier (ID), a transaction type (e.g., payment,gambling, etc.), an encrypted transaction ID, a parent transaction ID, acreated and/or update date, a US dollar equivalent amount (e.g., wherecredits and sent payments may be in a negative format), a local currencyamount and/or code, a billing and/or shipping address, a funding sourceand/or backup funding source, a bank account number, a bank hash-basedmessage authentication code (HMAC), a card number and/or hash, a cardbun HMAC, a card issuer, a balance and/or impact on a balance due to thetransaction, a transaction status and/or items within the transaction,notes and/or subject lines within messages for the transaction, anautomated clearinghouse return codes, an ID on another marketplace orplatform, a counterparty name, a counterparty account number, acounterparty account type, a counterparty country code, a counterpartyemail, a counterparty transaction ID, a counterparty ID on a marketplaceor platform, a counterparty account status, a referring URL, an IPaddress, whether the transaction was successful, and a date (e.g.,month/year) of transaction.

Other exemplary features and/or categories of features in the trainingdata that may be important to training the values and weights of amachine learning model may include risk rules regarding flagging oftransactions as incorrect descriptions or messages, complaints and flagsby other parties within transactions, gambling activities includingfantasy sports, specific country accounts and transaction activitiesfrom countries marked as high risk for money laundering and/or fraud, asame or similar account owner for a sender and receiver in atransaction, counterfeit flagged accounts, volume of payments in a highrisk transaction corridor or category, a spike in activity ortransaction value after a dormant or inactive period, a number oftransactions and total amount (including if the transactions werecross-border transactions), a previous account takeover flag, amalicious seller flag, an account restriction due to previous malicioususe or rule violation, a cross-border payment from a device usingin-person payment instrument processing (e.g., through processing apayment card EMV chip or magnetic stripe to provide the payment), acheck deposit amount and transfer of deposited funds, a deposit andwithdrawal/transfer of all or a substantial portion of the depositwithin a time period, a gift card usage and withdrawal/transfer of suchfunds, a premier account usage and activity/inactivity, and/or a numberof transactions between the same parties.

When generating machine learning engine 132, the features in thetraining data set(s) may be used to generate different layers of amachine learning model used to detect the prohibited transactions, whichmay include different nodes, values, weights, and the like, as discussedin reference to an exemplary machine learning model of FIG. 2 . Machinelearning engine 132 may utilize a supervised machine learning algorithm,function, or technique that utilizes continuous and/or iterativelearning to generate the model. In some embodiments, the algorithm andtechnique to generate the model of machine learning engine 132 maycorrespond to a deep learning network, including a convolution neuralnetwork, a recurrent neural network, or a deep neural network. Whentraining the model, risk analysis application 130 may utilize feedbackand annotations or labeling from an agent to iteratively train themodel. For example, transactions in the training data set and/or otherdata sets may be flagged using the machine learning technique toidentify prohibited transactions, where the agent may indicate that theflagged transactions were not actually prohibited (e.g., not indicativeor including money laundering). Identification of these false positivesmay be used to retrain the model of machine learning engine 132 in acontinuous and/or iterative process so that false positives may bereduced and/or eliminated and machine learning engine 132 may moreaccurately predict and detect money laundering or other prohibitedtransactions. Thus, risk analysis application 130 and/or machinelearning engine 132 is trained for detection of prohibited transactions,as well as review of results from machine learning engine 132 that hasbeen modeled for prohibited transaction detection.

When training machine learning engine 132 and/or processing othertransaction data sets, a narrative generator 134 may also be used byrisk analysis application 130 to provide a textual and/or visualexplanation of why machine learning engine 132 identified certaintransactions as prohibited. This explanation and narrative may assistthe agents reviewing transactions flagged as prohibited in determiningwhether the transactions are prohibited. For example, narrativegenerator 134 may utilize, as input, an output graph from a machinelearning prediction explainer and/or a neural network predictionexplainer (e.g., local interpretable model-agnostic explanations (LIME)or SHapley Additive exPlanations (SHAP)). The output graph may include afeature importance of each feature in the flagged transactions (orunflagged transactions, as necessary for agent review), where thefeature importance includes data indicating how important the featurewas in classifying the transaction (e.g., flagging the transaction asprohibited or not). The output graph may therefore include data showinghow the model utilizes the classifiers to classify data points withinthe training data. Using the output graph, narrative generator may thengenerate a narrative, which may be output with the flagged (orunflagged) transactions to display why machine learning engine 132 madeparticular decisions or predictions.

Transaction processing application 122 may correspond to one or moreprocesses to execute modules and associated specialized hardware ofservice provider server 120 to process a transaction, which may includetransactions used for training data for training a machine learningmodel by risk analysis application 130 or otherwise processing thetransaction data to identify transactions flagged as prohibited by themachine learning model. In this regard, transaction processingapplication 122 may correspond to specialized hardware and/or softwareused by a user to establish a payment account and/or digital wallet,which may be used to generate and provide user data for the user, aswell as process transactions. In various embodiments, financialinformation may be stored to the account, such as account/card numbersand information. A digital token for the account/wallet may be used tosend and process payments, for example, through operations provided byservice provider server 120. In some embodiments, the financialinformation may also be used to establish a payment account. The paymentaccount may be accessed and/or used through a browser application and/ordedicated payment application to engage in transaction processingthrough transaction processing application 122 that generatestransactions used for training a machine learning or other AI model forprohibited transaction identification. Transaction processingapplication 122 may process the payment and may provide a transactionhistory that is used for transaction data in transaction data sets usedto train and utilize the model for prohibited transactionidentification.

Additionally, service provider server 120 includes database 124according to various embodiments. Database 124 may store variousidentifiers associated with agent device 110. Database 124 may alsostore account data, including payment instruments and authenticationcredentials, as well as transaction processing histories and data forprocessed transactions. Database 124 may store financial information andtokenization data. Database 124 may further store data necessary fortraining and utilizing a machine learning model, such as training data125 that may include transactions used to train a machine learning or AImodel and any false positive feedback from an agent. Further database124 may include transactions 126 used for training a model forprocessing future transactions by service provider server 120 or anothertransaction processing entity, where transactions 126 may be processedby the model to identify prohibited transactions. Database 124 mayfurther include narratives for training data 125 and/or transactions 126generated by the model and model explainer that includes a descriptionof why the model flagged particular transactions as prohibited.

In various embodiments, service provider server 120 includes at leastone network interface component 128 adapted to communicate agent device110 and/or other entities over network 140. In various embodiments,network interface component 128 may comprise a DSL (e.g., DigitalSubscriber Line) modem, a PSTN (Public Switched Telephone Network)modem, an Ethernet device, a broadband device, a satellite device and/orvarious other types of wired and/or wireless network communicationdevices including microwave, radio frequency (RF), and infrared (IR)communication devices.

Network 140 may be implemented as a single network or a combination ofmultiple networks. For example, in various embodiments, network 140 mayinclude the Internet or one or more intranets, landline networks,wireless networks, and/or other appropriate types of networks. Thus,network 140 may correspond to small scale communication networks, suchas a private or local area network, or a larger scale network, such as awide area network or the Internet, accessible by the various componentsof system 100.

FIG. 2 is an exemplary system environment of an artificial neuralnetwork 200 implementing a machine learning model trained forclassifications based on training data, according to an embodiment. Inthis regard, neural network 200 shows an input layer 202, a hidden layer204, and an output layer 206 of the artificial neural networkimplementing a machine learning model trained as discussed herein, wherethe nodes and weights for the hidden layer may be trained using one ormore training data sets of transactions for identification of patternsof prohibited conduct or behavior in transaction performance (e.g.,transaction processing between users or other entities).

For example, when training machine learning engine 132, one or moretraining data sets of training data 230 for transactions havingdifferent features and feature values may be processed using asupervised machine learning algorithm or technique, such as gradientboosting or random forest algorithms. In some embodiments, other typesof AI learning may be used, such as deep learning for neural networks.The features within training data 230 may include different types ofvariables, parameters, or characteristics of the underlyingtransactions, which may have separate values to the variables. Thisallows for different classifiers of the transactions and variables to bebuilt into known or desired classifications (e.g., “prohibitedtransaction” or “flagged transaction for review”). These classifiers aretrained to detect the transactions of training data 230 falling into theclassifier using the machine learning technique, which allowsidentification of similar transactions meeting a specificclassification. The classifiers may be generated by the machine learningtechnique when identifying and grouping transactions and/or designatedby a user or agent of the training data set. Thus, training data 230 mayinclude transactions falling into specific classifications, such asprohibited transactions and valid or not prohibited transactions. Theprocess may be supervised where the output and classifications are knownfor the transactions. In some embodiments, the training data set mayinclude annotated or labeled data of particular flagged transactionsand/or may be reviewed after processed and classified by the machinelearning technique for false positives and/or correctly identified andflagged as prohibited transactions.

Neural network 200 may therefore implement a machine learning model ofmachine learning engine 132 (e.g., a model trained using training data230 of transactions having potentially prohibited transactions). Neuralnetwork 200 includes different layers and nodes to performdecision-making using the machine learning model. Each of layers 202,204, and 206 may include one or more nodes. For example, input layer 202includes nodes 208-214, hidden layer 204 includes nodes 216-218, andoutput layer 206 includes a node 222. In this example, each node in alayer is connected to every node in an adjacent layer. For example, node208 in input layer 202 is connected to both of nodes 216 and 218 inhidden layer 204. Similarly, node 216 in the hidden layer is connectedto all of nodes 208-214 in input layer 202 and node 222 in output layer206. Although only one hidden layer is shown for neural network 200, ithas been contemplated that neural network 200 used to implement themachine learning model for prohibited transaction detection may includeas many hidden layers as desired.

In this example, neural network 200 receives a set of input values andproduces an output value. Each node in input layer 202 may correspond toa distinct input value. For example, when neural network 200 is used toimplement the machine learning model for prohibited transactiondetection, each node in the input layer 202 may correspond to a distinctattribute derived from the information associated with a transaction(e.g., a transaction time, currency amount, USD equivalent amount,balance affect or account balance, local or general time/date, etc.). Ina non-limiting example, node 208 may correspond to an account identifieror name, node 210 may correspond to a network address used by a sendingor receiving account, node 212 may correspond to an amount for thetransaction, and node 214 may correspond to an encoded valuerepresenting a set of additional values derived from training data 230.

In some embodiments, each of nodes 216-218 in hidden layer 204 generatesa representation, which may include a mathematical computation (oralgorithm) that produces a value based on the input values received fromnodes 208-214. The mathematical computation may include assigningdifferent weights to each of the data values received from nodes208-214. Nodes 216 and 218 may include different algorithms and/ordifferent weights assigned to the data variables from nodes 208-214 suchthat each of nodes 216 and 218 may produce a different value based onthe same input values received from nodes 208-214. In some embodiments,the weights that are initially assigned to the features (or inputvalues) for each of nodes 216 and 218 may be randomly generated (e.g.,using a computer randomizer). The values generated by nodes 216 and 218may be used by node 222 in output layer 206 to produce an output valuefor neural network 200. When neural network 200 is used to implement themachine learning model for prohibited transaction detection, the outputvalue produced by neural network 200 may indicate a likelihood that atransaction is prohibited (e.g., a malicious, fraudulent, or illegaltransaction).

Neural network 200 may be trained by using training data. By providingtraining data 230 to neural network 200, nodes 216 and 218 in hiddenlayer 204 may be trained (adjusted) such that an optimal output (e.g., aclassification) is produced in output layer 206 based on the trainingdata. By continuously providing different sets of training data, andpenalizing neural network 200 when the output of neural network 200 isincorrect (e.g., when the determined (predicted) prohibited transactionis actually valid, such as a false positive designated by an agent),neural network 200 (and specifically, the representations of the nodesin hidden layer 204) may be trained (adjusted) to improve itsperformance in data classification. Adjusting neural network 200 mayinclude adjusting the weights associated with each node in hidden layer204.

FIG. 3A is an exemplary feature importance of decision made by a machinelearning engine trained for prohibited transaction detection, accordingto an embodiment. In this regard, model prediction explainer 300 a inFIG. 3A includes feature importance 1100 that provides output valuesshowing different feature importance for a machine learning model inmaking particular decisions, such as flagging a transaction aspotentially prohibited due to laws, regulations, or other requirements(e.g., money laundering transactions). Feature importance 1100 mayprovide an analysis of features within a specific machine learning modeltrained using training data sets for transactions and an algorithm, suchas gradient boosting or random forest. Feature importance 1100 ingradient boosting may provide a score that indicates the value orusefulness of each feature from the training data set in constructionand decision-making within the decision trees of the machine learningmodel. This allows different attributes or features in the dataset(e.g., the attributes or features to transactions within the trainingdata) to be ranked and compared when the trained machine learning modelis making decisions and classifying data, such as flagging transactionsas potentially prohibited. Importance of particular features may bedetermined by an amount or factor that each feature affects or improvesthe performance measure of the model, which may be weighted by thenumber of observations for a node. When using gradient boosting orrandom forest, this may also be averaged over the individual trees.

Thus, feature importance 1100 allows for an explanation of why aparticular model is making certain decisions and the features of theunderlying data that is utilized to make a classification. In thisregard, a normalized importance 1102 may show a value of each particularfactor in making a particular decision. Model prediction explainer 300 ashows different features 1104 that are used to make decisions by themodel, and the effect that each of features 1104 has to the model whenmaking a decision. For example, features 1104 include at least a “timedifference (in hours),” a “cumulative amount,” a “USD equivalent value,”a “local currency amount,” an “account number,” an “IP address,” a“shipping address,” and a “balance impact” on one or more of theaccounts in the transaction (e.g., 1 or 0). As shown, a time difference1106 feature or attribute is ranked as the most important feature indecision-making for the machine learning model explained by modelprediction explainer 300 a. This prediction explainer is furtherdiscussed in reference to FIG. 3B.

FIG. 3B is an exemplary explanation graph of a machine learning enginetrained for prohibited transaction detection, according to anembodiment. A machine learning prediction explainer may be used to showexplanation output graph 300 b to explain why a machine learning modelhas taken or performed a decision based on feature importance 1100 inmodel prediction explainer 300 a. For example, model output value 1202shows an effect on a prediction by each feature of features 1204(corresponding to features 1104 in FIG. 3A), where the effect on theprediction may be positive or negative and weighted depending on theiroverall feature importance. For example, a model decision-making effect1206 shows each of features 1204 effect on model output value 1202. Thisfurther shows whether the feature causes a positive or negative effectin performing a classification of a data point (e.g., transaction) intoa particular classifier (e.g., flagged or potentially prohibitedtransaction). Using model prediction explainer 300 a and/or explanationoutput graph 300 b, a narrative may be generated for a particulardecision that the machine learning model makes after being trained onthe training data and any false positive feedback by agents reviewingflagged transactions.

For example, using the data provided in FIG. 3A and/or FIG. 3B, apattern of potentially prohibited transaction(s) may be detected for oneor more accounts. A transaction and/or account performing thetransactions may be flagged through use of the machine learning modeland network discussed herein. In this regard, when flagging thetransaction and/or account, explanation output graph 300 b or anotherexplanation output graph (e.g., for another model) may be utilized thatassist in generating a textual narrative according to the featureimportance and decision-making performed by the machine learning modelfor the transaction(s). An exemplary narrative may appear as follows:

-   -   Account #1234xxxxxxx5678. Summary: The BUSINESS account was        created on Mar. 18, 2011. The name of the business is        MERCHANT A. The account receives payments utilizing the        following products: Express Checkout Payment and General Payment        and sends payments using Express Checkout Payment.    -   Transactions involving the account: A total of 49 transactions        took place between Oct. 1, 2016 and May 1, 2017 with 48 payments        received and 1 payment sent. During this timeframe, the sent        transaction made up a total of $39.99 USD and received        transactions made up a total of $1,602.50 USD. 79.59% of        transactions are categorized as personal. The average amount of        $33.39 USD was received and the average amount of $39.99 USD was        sent.    -   The top 2 transaction types received were Express Checkout        Payment and General Payment. Express Checkout Payment's highest        payment received was “Soccer Jersey-Black” for $99.80 USD.        General Payment's highest payment received was “Payment Sent”        for $20.00 USD. The top transaction type sent was Express        Checkout Payment. Express Checkout Payment's highest payment        sent was “eTextbook-ebook” for $39.99 USD.    -   Some received transactions were domestic in nature making up        approximately 4.17% of transactions totaling $40.00 USD and        0.00% of sent transactions were domestic, totaling $0.00 USD.        The highest concentration of payments was received from USER A        (9876xxxxxxxxxx4321), indicating the payment was for “Payment        Sent.”

As shown above, the narrative explanation takes particular features ofthe feature importance and effect on prediction of the features providedby the machine learning prediction explainer. This may include the topfeature contributing to the model prediction and/or the top featuredetected in the particular transaction(s) as causing the classificationof the transaction(s) and/or account as potentially engaging inprohibited behavior. The features may also correspond to a number of thetop ranked features (e.g., the top three or five features contributingto a decision) or may make a sampling of a set of the positive andnegative features to decision-making. The narrative further showstextual information of the explanation output graph for a machinelearning prediction explainer, which allows an agent to quickly reviewthe transaction(s) and determine whether this is a false positive. Forexample, the agent may view that the payments received were for soccerjerseys and the user was purchasing text books, indicating a possiblestudent and therefore unlikely to be involved in money laundering. Thus,the agent may indicate this is a false positive.

Another exemplary narrative may be as follows:

-   -   Account #4321xxxxxxxxxx7890 Summary: The BUSINESS account was        created on May 1, 2018. The name of the business is FOOD LTD.        The account receives payments utilizing the following product:        Website Payments. Transactions: A total of 5,000 transactions        took place between Jun 1, 2018 and Sep 1, 2018 with 5,000        payments received and 0 payments sent. During this timeframe,        sent transactions made up a total of $0.00 USD and received        transactions made up a total of $600,000.00 USD. 37.19% of        transactions are categorized as personal. The average amount of        $120.00 USD was received and the average amount of $0.00 USD was        sent.    -   The top transaction type received was Website Payment. Website        Payment's highest payment received was “FOOD LTD” for $8,650.62        USD. The majority of received transactions were domestic in        nature making up approximately 97.49% of transactions totaling        $550,000.00 USD and 0.00% of sent transactions were domestic,        totaling $0.00 USD. The highest concentration of payments were        received from USER B (5678xxxxxxxxxx0987), indicating the        payments were for “Food items.”

In the preceding example, due to the number of transactions with no senttransactions, as well as other features of the transactions, thetransactions and account may be properly flagged for review and/orindicating prohibited transactions and conduct. Thus, the narrative mayassist an agent in determining that these were properly flagged by themachine learning model.

FIG. 4 is a flowchart 400 of a machine learning model and narrativegenerator for prohibited transaction detection and compliance, accordingto an embodiment. Note that one or more steps, processes, and methodsdescribed herein of flowchart 400 may be omitted, performed in adifferent sequence, or combined as desired or appropriate.

At step 402 of flowchart 400, training data for transaction reviewed forprohibited transactions is accessed. The training data may correspond todata sets having different data points (e.g., transactions) that may beprocessed or accessible to an entity, such as those processed by anonline transaction processor, financial entity, or other paymentprocessor. In this regard, the training data may include differentfeatures and/or attributes, where these describe the transactions andallow for decision-making based on the transactions. In someembodiments, classifiers for the data may be designated (e.g.,“prohibited transactions”) and/or the data sets may be annotated orlabeled with particular transactions flagged as prohibited. The trainingdata may therefore include data that may be processed by agents of theservice provider or other entity to determine whether any of thetransactions indicate money laundering or other prohibited behavior.Moreover, the training data may also include transaction data processedby the regulatory agency of those transactions that are actuallyprohibited (e.g., a legal or other action has been or will be taken bythe agency) and those that are not prohibited or do not rise to thedegree of prohibited behavior to cause an action. Thus, such data may belabeled.

Using the training data, at step 404, flagged transactions areidentified using a machine learning algorithm. The machine learningalgorithm may be supervised (e.g., where the classifiers for the datapoints are known) and may correspond to gradient boosting and/or randomforest that use combinations and/or averages of different decision treesfor generation of a machine learning model by processing the trainingdata to recognize patterns and/or group specific transactions accordingto their features. When identifying flagged transactions, the supervisedmachine learning algorithm and process may be used to initial makepredictions and generate a model, which may output which transactionswithin the training data set are flagged for potentially prohibitedbehavior. When implementing the trained machine learning model through aneural network, the input values may be used for transactions to form anoutput, which may correspond to whether the transaction is flagged ornot as prohibited.

In order to determine whether transactions flagged by the initiallytrained model include false positives (e.g., for iterative and/orcontinuous model retraining), an explanation of the particular flaggedtransactions may be required. Thus, narratives for flagged transactionsare determined and output for review, such as to an agent associatedwith reporting prohibited transactions to a regulatory agency, at step406. To generate the narratives, a machine learning prediction explainermay be utilized to output a feature importance graph or otherdisplayable format of the overall importance, ranking, or value to eachfeature in causing a particular classification by the machine learningmodel. The feature importance may include a value that the featurecontributes to certain decision-making, allowing a view of whichfeatures are the most important and comparing features in machinelearning decisions by the model. An explanation output graph may furtherbe utilized to determine the positive and negative impacts or effects onthe prediction by each feature, as well as the amount of the particularpositive or negative effect to the decision-making of the model.

Using the explanation output graph, the narratives may be generated. Thenarratives may include different information associated with thetransactions and/or accounts to allow identification of the particulartransactions and/or accounts, as well as provide context to an agentreviewing the flagged transactions. The narratives may also provideinformation on the features of the transactions that caused flagging,which may be ranked or selected based on the feature importance. Forexample, if a feature importance shows account age (e.g., length accountis open) or transaction amount as the highest feature todecision-making, then the account age or transaction amount may bedisplayed. Where the feature is not available or does not apply to theparticular transaction, the next highest feature may be selected.Further, both positive and negative effecting features may be displayed,as well as a number based on ranking or importance. The narrative mayprovide a textual output having the particular data in readable form sothat the output graphs are not required to be reviewed but instead thenarrative may be read to determine whether the transactions wereproperly flagged or may be false positives. Thus, an agent may providefeedback on what is properly flagged.

At step 408, a machine learning model is then iteratively trained usingthe flagged transactions and agent review of the false positivesidentified in the flagged transactions. Iteratively training may allowfor retraining, adjusting weights and/or values of nodes with treesand/or hidden layers, and otherwise adjust the machine learning model tomake better or different predictions, such as to lower or remove falsepositives. Once the machine learning model is trained, the machinelearning model may be provided and/or output to one or more entities forprediction of prohibited transactions and generation of narratives. Forexample, an entity (e.g., the service provider or transaction processortraining the model using the training data of transactions for theentity) may implement the model within a machine learning engine andprohibited transaction detector. Thereafter, the network, engine, orother detector implementing the model may receive transaction data fordetection of prohibited transactions, at step 410.

Potentially prohibited transactions are then identified in thetransaction data using the machine learning model that has beeniteratively trained using the supervised machine learning algorithm, atstep 412. The potentially prohibited transactions may be identifiedusing the trained model and the particular nodes, values, and weights ofthe decision-making layers. The potentially prohibited transactions maybe identified based on the features of the transactions and further onthe training of the classifiers by the machine learning algorithm whengenerating the model. Once those potentially prohibited transactions areidentified, at step 414, narratives are determined for the potentiallyprohibited transactions using the machine learning prediction explainerand a narrative generator. This further uses the explanation outputgraph that includes data of how the features contribute to thedecision-making of the model. This may then be displayed to an agent forreview and/or submission of the transactions identified as potentiallyprohibited to the regulatory agency. Moreover, additional falsepositives may be identified by an agent when utilizing the model, whichmay be used for further model optimization in an attempt to remove falsepositives.

FIG. 5 is a block diagram of a computer system suitable for implementingone or more components in FIG. 1 , according to an embodiment. Invarious embodiments, the communication device may comprise a personalcomputing device e.g., smart phone, a computing tablet, a personalcomputer, laptop, a wearable computing device such as glasses or awatch, Bluetooth device, key FOB, badge, etc.) capable of communicatingwith the network. The service provider may utilize a network computingdevice (e.g., a network server) capable of communicating with thenetwork. It should be appreciated that each of the devices utilized byusers and service providers may be implemented as computer system 500 ina manner as follows.

Computer system 500 includes a bus 502 or other communication mechanismfor communicating information data, signals, and information betweenvarious components of computer system 500. Components include aninput/output (I/O) component 504 that processes a user action, such asselecting keys from a keypad/keyboard, selecting one or more buttons,image, or links, and/or moving one or more images, etc., and sends acorresponding signal to bus 502. I/O component 504 may also include anoutput component, such as a display 511 and a cursor control 513 (suchas a keyboard, keypad, mouse, etc.). An optional audio input/outputcomponent 505 may also be included to allow a user to use voice forinputting information by converting audio signals. Audio I/O component505 may allow the user to hear audio. A transceiver or network interface506 transmits and receives signals between computer system 500 and otherdevices, such as another communication device, service device, or aservice provider server via network 140. In one embodiment, thetransmission is wireless, although other transmission mediums andmethods may also be suitable. One or more processors 512, which can be amicro-controller, digital signal processor (DSP), or other processingcomponent, processes these various signals, such as for display oncomputer system 500 or transmission to other devices via a communicationlink 518. Processor(s) 512 may also control transmission of information,such as cookies or IP addresses, to other devices.

Components of computer system 500 also include a system memory component514 (e.g., RAM), a static storage component 516 (e.g., ROM), and/or adisk drive 517. Computer system 500 performs specific operations byprocessor(s) 512 and other components by executing one or more sequencesof instructions contained in system memory component 514. Logic may beencoded in a computer readable medium, which may refer to any mediumthat participates in providing instructions to processor(s) 512 forexecution. Such a medium may take many forms, including but not limitedto, non-volatile media, volatile media, and transmission media. Invarious embodiments, non-volatile media includes optical or magneticdisks, volatile media includes dynamic memory, such as system memorycomponent 514, and transmission media includes coaxial cables, copperwire, and fiber optics, including wires that comprise bus 502. In oneembodiment, the logic is encoded in non-transitory computer readablemedium. In one example, transmission media may take the form of acousticor light waves, such as those generated during radio wave, optical, andinfrared data communications.

Some common forms of computer readable media includes, for example,floppy disk, flexible disk, hard disk, magnetic tape, any other magneticmedium, CD-ROM, any other optical medium, punch cards, paper tape, anyother physical medium with patterns of holes, RAM, PROM, EEPROM,FLASH-EEPROM, any other memory chip or cartridge, or any other mediumfrom which a computer is adapted to read.

In various embodiments of the present disclosure, execution ofinstruction sequences to practice the present disclosure may beperformed by computer system 500. In various other embodiments of thepresent disclosure, a plurality of computer systems 500 coupled bycommunication link 518 to the network (e.g., such as a LAN, WLAN, PTSN,and/or various other wired or wireless networks, includingtelecommunications, mobile, and cellular phone networks) may performinstruction sequences to practice the present disclosure in coordinationwith one another.

Where applicable, various embodiments provided by the present disclosuremay be implemented using hardware, software, or combinations of hardwareand software. Also, where applicable, the various hardware componentsand/or software components set forth herein may be combined intocomposite components comprising software, hardware, and/or both withoutdeparting from the spirit of the present disclosure. Where applicable,the various hardware components and/or software components set forthherein may be separated into sub-components comprising software,hardware, or both without departing from the scope of the presentdisclosure. In addition, where applicable, it is contemplated thatsoftware components may be implemented as hardware components andvice-versa.

Software, in accordance with the present disclosure, such as programcode and/or data, may be stored on one or more computer readablemediums. It is also contemplated that software identified herein may beimplemented using one or more general purpose or specific purposecomputers and/or computer systems, networked and/or otherwise. Whereapplicable, the ordering of various steps described herein may bechanged, combined into composite steps, and/or separated into sub-stepsto provide features described herein.

The foregoing disclosure is not intended to limit the present disclosureto the precise forms or particular fields of use disclosed. As such, itis contemplated that various alternate embodiments and/or modificationsto the present disclosure, whether explicitly described or impliedherein, are possible in light of the disclosure. Having thus describedembodiments of the present disclosure, persons of ordinary skill in theart will recognize that changes may be made in form and detail withoutdeparting from the scope of the present disclosure. Thus, the presentdisclosure is limited only by the claims.

1. (canceled)
 2. A system, comprising: a non-transitory memory; and oneor more hardware processors coupled to the non-transitory memory andconfigured to read instructions from the non-transitory memory to causethe system to perform operations comprising: receiving transaction datafor processed transactions; determining a supervised machine learningmodel trained for prohibited transaction pattern detection using atraining data set; determining a first prohibited transaction within thetransaction data using the supervised machine learning model andfeatures of the transaction data; generating a machine learningprediction explainer for the first prohibited transaction of at leastone of the features for the first prohibited transaction; providing anagent narrative for the first prohibited transaction based on themachine learning prediction explainer; and retraining the supervisedmachine learning model based on an agent response to the agentnarrative.
 3. The system of claim 2, wherein determining the firstprohibited transaction generates a review flag for the first prohibitedtransaction with a flag type indicating a reason for prohibiting thefirst prohibited transaction.
 4. The system of claim 3, wherein theagent narrative comprises a textual conversion of an output graph forthe machine learning prediction explainer of the at least one of thefeatures for the first prohibited transaction, and wherein the outputgraph shows a feature importance of the at least one of the features incausing the determining the first prohibited transaction.
 5. The systemof claim 3, wherein the operations further comprise: receiving an agentresponse to the agent narrative, the agent response identifying a falsepositive identification for the first prohibited transaction; andmodifying the review flag and flag type based on the agent response andthe false positive identification.
 6. The system of claim 2, whereinretraining the supervised machine learning model further comprises:determining the agent response includes a false positive indication forthe first prohibited transaction; and triggering an iterative trainingof the supervised machine learning model based on the false positiveindication.
 7. The system of claim 6, wherein the iterative training ofthe supervised machine learning model is triggered based on a set offalse positive indications including the false positive indication forthe first prohibited transaction and one or more previous false positiveindications for one or more previous prohibited transactions.
 8. Thesystem of claim 2, wherein retraining the supervised machine learningmodel further comprises: determining the agent response includes a falsepositive indication for the first prohibited transaction; andincorporating the false positive indication into a continuous modelretraining.
 9. A method, comprising: receiving transaction data forprocessed transactions; determining a supervised machine learning modeliteratively trained for prohibited transaction pattern detection using atraining data set, prohibited transactions within the training data setidentified using the supervised machine learning model, and falsepositive identification for valid transactions identified as potentiallyprohibited in the training data set; determining a first prohibitedtransaction within the transaction data using the supervised machinelearning model and features of the transaction data; generating amachine learning prediction explainer for the first prohibitedtransaction of at least one of the features for the first prohibitedtransaction; and providing an agent narrative for the first prohibitedtransaction based on the machine learning prediction explainer.
 10. Themethod of claim 9, wherein the agent narrative is provided to an agentassociated with the transaction data through a case management systemfor the transaction data, and wherein the case management systemprovides transaction review operations for the first prohibitedtransaction and the agent narrative.
 11. The method of claim 9, whereinthe agent narrative comprises a textual conversion of an output graphfor the machine learning prediction explainer of the at least one of thefeatures for the first prohibited transaction, and wherein the outputgraph shows a feature importance of the at least one of the features incausing the determining the first prohibited transaction.
 12. The methodof claim 11, wherein the agent narrative ranks an importance of each ofthe at least one of the features that causes the determining the firstprohibited transaction.
 13. The method of claim 9, wherein thesupervised machine learning model is trained using reports generated forthe prohibited transactions that were flagged within the training dataset, and wherein an agent associated with the training data set providesthe false positive identification.
 14. The method of claim 9, whereinthe supervised machine learning model is trained using the training dataset and one of a gradient boosting operation or a deep learningoperation.
 15. A non-transitory machine-readable medium havinginstructions stored thereon that are executed by a computer system toperform operations comprising: receiving transaction data for processedtransactions; determining a supervised machine learning modeliteratively trained for prohibited transaction pattern detection using atraining data set and prohibited transactions within the training dataset identified using the supervised machine learning model; determininga set of prohibited transactions within the transaction data using thesupervised machine learning model and features of the transaction data;generating a machine learning prediction explainer for each prohibitedtransaction of the set of prohibited transactions of at least one of thefeatures for each of the prohibited transactions; providing an agentnarrative for each prohibited transaction of the set of prohibitedtransactions based on the machine learning prediction explainer; andretraining the supervised machine learning model based on one or moreagent responses to one or more agent narratives for the set ofprohibited transactions.
 16. The non-transitory machine-readable mediumof claim 15, wherein the agent narrative comprises a textual conversionof an output graph for the machine learning prediction explainer of theat least one of the features for each prohibited transaction of the setof prohibited transactions, and wherein the output graph shows a featureimportance of the at least one of the features in causing thedetermining the each prohibited transaction.
 17. The non-transitorymachine-readable medium of claim 16, wherein the agent narrative ranksan importance of each of the at least one of the features that causesthe determining for each prohibited transaction.
 18. The non-transitorymachine-readable medium of claim 15, wherein the supervised machinelearning model is trained using reports generated for the prohibitedtransactions that were flagged within the training data set, and whereinthe supervised machine learning model is retrained using agent responsesincluding false positive identifications.
 19. The non-transitorymachine-readable medium of claim 15, wherein retraining the supervisedmachine learning model further comprises: determining at least one agentresponse includes a false positive indication for a prohibitedtransaction of the set of prohibited transactions; and triggering aniterative training of the supervised machine learning model based on thefalse positive indication.
 20. The non-transitory machine-readablemedium of claim 15, wherein retraining the supervised machine learningmodel further comprises: determining at least one agent responseincludes a false positive indication for a prohibited transaction of theset of prohibited transactions; and incorporating the false positiveindication into a continuous model retraining.
 21. The non-transitorymachine-readable medium of claim 15, wherein the supervised machinelearning model is trained using the training data set and one of agradient boosting operation or a deep learning operation.